node-csv icon indicating copy to clipboard operation
node-csv copied to clipboard

Github vulnerability warning in v1.2.0 - (csv > csv-parse)

Open VineetKumarKushwaha opened this issue 5 years ago • 1 comments

We are using very old version v1.2.0 and getting below GitHub vulnerability warning related to csv-parse which is being used in your package.

  High            Regular Expression Denial of Service                          
                                                                                
  Package         csv-parse                                                     
                                                                                
  Dependency of   csv                                                           
                                                                                
  Path            csv > csv-parse                                               
                                                                                
  More info       https://npmjs.com/advisories/1171 

It would be very helpful if you can fix it and release one more version from v1. We will be migrating to the latest version but not in the 2020 scope so this change would help us.

VineetKumarKushwaha avatar May 30 '20 07:05 VineetKumarKushwaha

You can send me a pull request with the suggested changes. I'll review it, merge it and publish a new 1.2.1 version. I honestly don't have the time to support old releases.

wdavidw avatar May 30 '20 11:05 wdavidw